Secure cookie fix #160
Merged
Secure cookie fix #160
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jayvaznewm
commented
Jun 23, 2023
newm-server/build.gradle.kts
Outdated
| @@ -57,6 +57,7 @@ dependencies { | |||
| implementation(Dependencies.Ktor.SERIALIZATION_JSON) | |||
| implementation(Dependencies.Ktor.SERVER_STATUS_PAGES) | |||
| implementation(Dependencies.Ktor.SERVER_CORS) | |||
| implementation(Dependencies.Ktor.SERVER_FORWARDED_HEADER) | |||
There was a problem hiding this comment.
per ktorio/ktor#1112 - ktor verifies that you are using https protcol when you set the Secure option on a cookie. Because CIO does not support https we need to add support for forwarding X-Forwarded-SSL headers in order to use Secure cookies
jayvaznewm
commented
Jun 23, 2023
| @@ -4,10 +4,9 @@ import kotlinx.serialization.Serializable | |||
|
|
|||
| @Serializable | |||
| data class AudioStreamResponse( | |||
| val url: String, | |||
| val cookies: Map<String, String> | |||
| val url: String | |||
There was a problem hiding this comment.
Removed cookie argument because it is not required in the response (cookies are passed in the header)
jayvaznewm
commented
Jun 23, 2023
| @@ -789,6 +789,9 @@ class SongRoutesTests : BaseApplicationTests() { | |||
| val response = client.get("v1/songs/$songId/stream") { | |||
| bearerAuth(testUserToken) | |||
| contentType(ContentType.Application.Json) | |||
| url { | |||
There was a problem hiding this comment.
Have to explicitly set the test protocol to HTTPS in order to satisfy the Secure cookie check.
jayvaznewm
commented
Jun 23, 2023
| @@ -797,11 +800,6 @@ class SongRoutesTests : BaseApplicationTests() { | |||
| val environment: ApplicationEnvironment by inject() | |||
| val updatedHost = environment.getConfigString("aws.cloudFront.audioStream.hostUrl") | |||
| assertThat(resp.url).startsWith(updatedHost) | |||
|
|
|||
There was a problem hiding this comment.
No longer required
| response.cookies.append( | ||
| name = cookie.key, | ||
| value = cookie.value, | ||
| domain = "newm.io", |
There was a problem hiding this comment.
domain can be referenced from application.conf with a default value of "newm.io".
AndrewWestberg
approved these changes
Jun 24, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.